Air Force KC-X Aerial Refueling Tanker Aircraft Program

Report No. D-2007-103 May 30, 2007

Report Documentation Page Form ApprovedOMB No. 0704-0188

Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering andmaintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information,including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, ArlingtonVA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if itdoes not display a currently valid OMB control number.

1. REPORT DATE 30 MAY 2007 2. REPORT TYPE

3. DATES COVERED 00-00-2007 to 00-00-2007

4. TITLE AND SUBTITLE Air Force KC-X Aerial Refueling Tanker Aircraft Program

5a. CONTRACT NUMBER

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S) 5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) ODIG-AUD Department of Defense Inspector General,400 Army NavyDrive Suite 801,Arlington,VA,22202-4704

8. PERFORMING ORGANIZATIONREPORT NUMBER

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR/MONITOR’S ACRONYM(S)

11. SPONSOR/MONITOR’S REPORT NUMBER(S)

12. DISTRIBUTION/AVAILABILITY STATEMENT Approved for public release; distribution unlimited

13. SUPPLEMENTARY NOTES

14. ABSTRACT

15. SUBJECT TERMS

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF ABSTRACT Same as

Report (SAR)

18. NUMBEROF PAGES

43

19a. NAME OFRESPONSIBLE PERSON

a. REPORT unclassified

b. ABSTRACT unclassified

c. THIS PAGE unclassified

Standard Form 298 (Rev. 8-98) Prescribed by ANSI Std Z39-18

Additional Copies To obtain additional copies of this report, visit the Web site of the Department of Defense Inspector General at http://www.dodig.mil/audit/reports or contact the Secondary Reports Distribution Unit at (703) 604-8937 (DSN 664-8937) or fax (703) 604-8932. Suggestions for Future Audits To suggest ideas for or to request future audits, contact the Office of the Deputy Inspector General for Auditing at (703) 604-9142 (DSN 664-9142) or fax (703) 604-8932. Ideas and requests can also be mailed to:

ODIG-AUD (ATTN: Audit Suggestions) Department of Defense Inspector General

400 Army Navy Drive (Room 801) Arlington, VA 22202-4704

Acronyms

DIACAP DoD Information Assurance Certification and Accreditation Process

DITSCAP DoD Information Technology Security Certification and Accreditation Process

FAR Federal Acquisition Regulation GAO Government Accountability Office IG Inspector General

INSPECTOR GENERALDEPARTMENT OF DEFENSE

400 ARMY NAVY DRIVEARLINGTON, VIRGINIA 22202-4704

May 30, 2007

MEMORANDUM FOR ASSISTANT SECRETARY OF DEFENSE FOR NETWORKSAND INFORMAnON INTEGRATIONIDOD CHIEFINFORMATION OFFICER

ASSISTANT SECRETARY OF THE AIR FORCE(FINANCIAL MANAGEMENT AND COMPTROLLER)

DIRECTOR, ADMINISTRAnON AND MANAGEMENT

SUBJECT: Report on the Air Force KC-X Aerial Refueling Tanker Aircraft Program(Report No. D-2007-103)

We are providing this report for review and comment. The Director,Administration and Management did not respond to the draft report; however, weconsidered comments from the Assistant Secretary of the Air Force (Acquisition) and theAssistant Secretary of Defense for Networks and Information Integration! DoD ChiefInformation Officer when preparing the final report. This report addresses full and opencompetition for the Air Force KC-X Aerial Refueling Tanker Aircraft Program and thecapability and acquisition requirements in the KC-X request for proposal.

We request that the Director, Administration and Management provide commentsto the final report by June 20, 2007 that conform to the requirements of DoD Directive7650.3.

If possible, please send management conunents in electronic format (AdobeAcrobat file only) to AudACM@dodig.mil. Copies of the management comments mustcontain the actual signature of the authorizing official. We cannot accept the / Signed /symbol in place of the actual signature. If you arrange to send classified commentselectronically, they must be sent over the SECRET Internet Protocol Router Network(SIPRNET).

We appreciate the courtesies extended to our staff. Questions should be directedto Mr. Benjamin A. Mehlman at (703) 604-9291 (DSN 664-9291) or Mr. Kenueth H.Stavenjord at (703) 604-8952 (DSN 664-8952). See Appendix F for the reportdistribution. The team members are listed inside the back cover.

Richard B. J0 liffeAssistant Inspector General

Acquisition and Contract ManagementActing Deputy Inspector General

Policy and Oversight

Department of Defense Office of Inspector General

Report No. D-2007-103 May 30, 2007 (Project Nos. D2007-D000AB-0099.000 and D2007-D000PT-0110.000)

Air Force KC-X Aerial Refueling Tanker Aircraft Program

Executive Summary

Why You Should Read This Report. This report discusses efforts by Air Force acquisition officials to develop an acquisition strategy to ensure that the Air Force maintains competition throughout the life-cycle of the Air Force KC-X Aerial Refueling Tanker Aircraft Program (the KC-X Program).

Background. On March 29, 2004, we issued DoD Inspector General Report No. D-2004-064, “Acquisition of the Boeing KC-767A Tanker Aircraft,” that identified deficiencies and shortcomings in the acquisition strategy that the Air Force developed to lease Boeing KC-767A Tanker aircraft. Since then, the Air Force revised its acquisition strategy and plans to recapitalize the aerial tanker fleet by developing three consecutive acquisition programs: KC-X, KC-Y, and KC-Z. The intention of those programs was to represent different tanker aircraft platforms. The KC-X Program is a major Defense acquisition program that will provide worldwide, day and night, and adverse weather aerial refueling to United States, allied, and coalition military aircraft. The KC-X aircraft are to replace approximately one-third of the warfighting capability provided by the current aerial refueling fleet of KC-135 tanker aircraft. On January 30, 2007, the Air Force issued a request for proposal for the KC-X Program. As of April 2007, the system development and demonstration phase of the program, which includes the manufacture of four test aircraft, is scheduled to begin in the first quarter of FY 2008 with low-rate initial production projected to begin in FY 2010. The Air Force plans to purchase 179 aircraft under the KC-X Program and for the first 43 aircraft, the Air Force projects program costs to total about $13 billion through FY 2013.

Results. To overcome the deficiencies and shortcomings in the previous leasing acquisition strategy for tanker aircraft, the Air Force changed from a sole-source to a competitive procurement acquisition strategy. To ensure full and open competition, the acquisition strategy for the KC-X Program provides for the Air Force to competitively contract for as many as 80 commercial derivative aircraft out of the intended procurement of 179 KC-X tanker aircraft. In preparing for the release of the request for proposal, the Air Force complied with the DoD 5000 series requirements that we identified as a shortcoming in the March 2004 audit report. Although the Air Force planned to compete the KC-X tanker aircraft and appropriately establish capabilities and DoD acquisition requirements, we identified two issues that required further action.

• For the remaining 99 of 179 KC-X aircraft identified in the KC-X acquisition strategy, the Air Force intended to acquire those aircraft as early as FY 2016 using a noncompetitive procurement action with the winner of the competition in the first quarter of FY 2008. In doing so, the Air Force did not include in the KC-X acquisition strategy a requirement to obtain accurate, complete, and current cost and pricing data to determine the reasonableness of the contractor’s proposed

price for the noncompetitive portion of the KC-X aircraft acquisition. As a result, the Air Force may not be in a position to effectively evaluate the reasonableness of the contractor’s proposed price for the 99 KC-X aircraft. The Program Director, 653rd Aeronautical Systems Squadron (KC-X Program Office) needs to update the acquisition strategy for the KC-X Program to include guidance for the noncompetitive portion of the KC-X aircraft acquisition. The additional guidance in the acquisition strategy should include a requirement to obtain certified cost and pricing data from the winning contractor for the future noncompetitive portion of the KC-X aircraft acquisition (finding A).

• The KC-X Program Office was not able to include consistent information assurance requirements in the KC-X capability development document, acquisition strategy, and request for proposal, because the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer issued interim DoD information assurance guidance without the proper coordination and approval of the Director, Administration and Management. In addition, the Assistant Secretary of the Air Force (Acquisition) needs to revise the applicable KC-X contractual documents to ensure consistency with the Director, Administration and Management approved information assurance policy (finding B).

For the competitive procurement of KC-X aircraft identified in the request for proposal, the Air Force had established adequate internal controls. For the noncompetitive portion of the KC-X aircraft acquisition, the Air Force had not. Thus, the noncompetitive portion had a non-material internal control weakness. In addition, the improper issuance by the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer of DoD information assurance certification and accreditation guidance was a non-material internal control weakness.

Management Comments and Audit Response. We provided a draft of this report on April 26, 2007. The Director, Administration and Management did not provide comments. The Assistant Secretary of the Air Force (Acquisition) concurred with the audit findings and the recommendations directed to the Air Force. Although not required to comment, the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer provided comments to finding B and its recommendations. We request that the Director, Administration and Management comment on this report by June 20, 2007. See the Management Comments section of the report for the complete text of the comments.

ii

Table of Contents

Executive Summary i

Background 1

Objectives 2

Review of Internal Controls 2

Findings

A. Acquisition of the KC-X Aerial Refueling Tanker 4 B. Properly Establishing Information Assurance Guidance 8

Appendixes

A. Scope and Methodology 12 Prior Coverage 15

B. Government Accountability Office Report 16 C. Recommendations Made to the Air Force in a Previous DoD Inspector

General Report on the Tanker Aircraft 18 D. KC-X Program Timeline of Events 22 E. Glossary 25 F. Report Distribution 29

Management Comments

Department of the Air Force 31 Assistant Secretary of Defense (Network Information and Integration) 33

Source: Airliners.Net http://www.airliners.net

KC-135 Stratotanker Aircraft

1

Background

We performed this audit at the request of a member of Senator John McCain’s staff. The staffer requested that we independently review and advise him on whether the Air Force request for proposal for the Air Force KC-X Aerial Refueling Tanker Aircraft Program (the KC-X Program) contained impediments to competition and whether the request for proposal included capability or operational requirements for aircraft refueling, passenger, and cargo transport. In addition, we reviewed actions that the Air Force took to correct shortcomings that we identified in DoD Inspector General (IG) Report No. D-2004-064, “Acquisition of the Boeing KC-767A Tanker Aircraft,” March 29, 2004.

Boeing KC-767A Tanker Aircraft Report. In DoD IG Report No. D-2004-064, we stated that the Air Force used an inappropriate procurement strategy and demonstrated neither best business practices nor prudent acquisition procedures to provide sufficient accountability for the KC-767A Tanker aircraft. We identified five statutory provisions that had not been satisfied relating to commercial items, testing (two statutes), cost-plus-a-percentage-of-cost system of contracting, and leases. We recommended that DoD not proceed with the program until it resolved issues pertaining to the procurement strategy, acquisition procedures, and statutory requirements.

Since that report, the Air Force revised its acquisition strategy from a sole-source to a competitive procurement strategy to address the shortcomings in the Boeing KC-767A Tanker aircraft report. The Air Force also plans to recapitalize the aerial tanker fleet by developing three consecutive acquisition programs: KC-X, KC-Y, and KC-Z. Those three programs may represent different tanker aircraft platforms. Appendix C provides a discussion of the Boeing KC-767A Tanker aircraft report and the Air Force actions to appropriately implement 14 recommendations in the report. Appendix E is a glossary of technical terms used in this report.

KC-X Program. The KC-X Program is a major Defense acquisition program that will provide worldwide, day and night, and adverse weather aerial refueling to United States, allied, and coalition military aircraft. The KC-X aircraft are to replace approximately one-third of the warfighting capability provided by the current aerial refueling fleet of KC-135 tanker aircraft. The figure on the opposite page shows the current KC-135 aerial tanker aircraft.

KC-X Acquisition Strategy. The KC-X Program acquisition strategy is focused on an existing commercial, Federal Aviation Administration, or equivalent, certified transport aircraft modified to meet U.S. Air Force requirements. Over a 15- to 20-year period, the Air Force plans to acquire as many as 179 KC-X aircraft by competitively procuring as many as 80 commercial-derivative aircraft. The Air Force retains an option to acquire at least 99 aircraft from the winner of the competitive procurement using a noncompetitive acquisition. Alternatively, the Air Force may bypass future KC-X aircraft in favor of a new KC-Y competition based on a different aircraft platform.

2

As of April 2007, the system development and demonstration phase of the program, which includes the manufacture of four test aircraft, is scheduled to begin in the first quarter of FY 2008. Low-rate initial production is projected to begin in FY 2010. For the first 43 aircraft, the Air Force projects program costs to be about $13 billion through FY 2013.

Timeline of Events. In August 2005, the Air Force released a request for information regarding a replacement aircraft for the KC-135. On September 23, 2005, the Acting Secretary of the Air Force directed the Air Force to cease all KC-X activities until it completed an assessment of the analysis of alternatives and coordinated with Congress. In March 2006, the RAND Corporation completed the analysis of alternatives for the Air Force. On April 13, 2006, the Under Secretary of Defense for Acquisition, Technology, and Logistics signed a memorandum authorizing the Air Force to resume the requirements and acquisition process for a competitive KC-X acquisition. On January 30, 2007, the 653rd Aeronautical Systems Squadron (the KC-X Program Office), which is responsible for management of the KC-X Program, issued a final request for proposal. Appendix D provides a timeline of events associated with the KC-X Program.

Objectives

Our audit objectives were to evaluate the overall acquisition strategy of the KC-X Program to promote full and open competition and to determine whether DoD capability and acquisition requirements had been appropriately established and included in the request for proposal for the KC-X Program. We did not specifically comment on the portion of the request received from a member of Senator John McCain’s staff that related to passenger and cargo capabilities since the Government Accountability Office (GAO) issued a report concerning this requirement. We discuss this GAO report in Appendix B. See Appendix A for a discussion of the scope and methodology and prior coverage related to the objectives.

Review of Internal Controls

Nonmaterial Internal Control Weaknesses. We did not identify any material weaknesses in the application of internal controls associated with the KC-X Program, as defined by DoD Instruction 5010.40, “Managers’ Internal Control (MIC) Program Procedures,” January 4, 2006. However, we did identify nonmaterial internal control weaknesses associated with the noncompetitive portion of the KC-X aircraft acquisition and with the issuance of improper DoD information assurance certification and accreditation guidance.

KC-X Program. The Air Force did not fully implement internal controls outlined in the Federal Acquisition Regulation (FAR), Subpart 7.105, “Contents of Written Acquisition Plans”; and FAR, Subpart 15.403-4, “Requiring Cost or Pricing Data,” relating to follow-on contracts. Specifically, the acquisition strategy for the KC-X Program did not address the specific actions needed to acquire the noncompetitive portion of the KC-X aircraft acquisition to ensure that

it receives a fair and reasonable price. Implementing Recommendation A. will improve Air Force contract procedures for the noncompetitive portion of the KC-X aircraft acquisition.

DoD Information Assurance Guidance. Although the internal controls outlined in DoD Directive 5025.1, “DoD Directives System,” July 14, 2004, clearly indicated the requirement for coordinating proposed DoD issuances and cancellations, the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer did not fully comply with them before issuing the DoD Information Assurance Certification and Accreditation Process (DIACAP) interim guidance. Specifically, the Assistant Secretary did not properly coordinate proposed DIACAP guidance and submit that guidance to the Director, Administration and Management for review, coordination, and approval. Implementing Recommendation B.1. will avoid confusion as to which information assurance certification and accreditation guidance the DoD and contractor personnel should use when establishing information assurance requirements for programs.

3

4

A. Acquisition of the KC-X Aerial Refueling Tanker

To overcome the deficiencies and shortcomings in the previous leasing acquisition strategy for the Boeing KC-767A Tanker aircraft, the Air Force changed from a sole-source to a competitive procurement acquisition strategy. To ensure full and open competition, the acquisition strategy for the KC-X Program provides for the Air Force to competitively contract for as many as 80 commercial derivative aircraft of the intended procurement of 179 KC-X tanker aircraft. In addition, the Air Force appropriately established and included capabilities and DoD acquisition requirements, including systems engineering, in the KC-X request for proposal. Although the Air Force planned to compete the KC-X tanker aircraft and appropriately establish capabilities and DoD acquisition requirements, we identified the following issue concerning the noncompetitive procurement for 99 of the intended 179 aircraft.

The Air Force did not have an approach for ensuring price reasonableness for the remaining acquisition of 99 KC-X aircraft. The Air Force planned to acquire those aircraft as early as FY 2016 using a noncompetitive procurement action with the winner of the initial competition. In doing so, the Air Force did not include in the KC-X acquisition strategy a requirement to obtain accurate, complete, and current cost and pricing data to determine the reasonableness of the contractor’s proposed price for the noncompetitive portion of the KC-X aircraft acquisition. As a result, the Air Force may not be in a position to effectively evaluate the reasonableness of the contractor’s proposed price for the 99 KC-X aircraft.

Competitive Procurement Acquisition Strategy

Full and Open Competition, Systems Engineering, Capability Requirements, Policy. DoD Directive 5000.1, “The Defense Acquisition System,” May 12, 2003; DoD Instruction 5000.2, “Operation of the Defense Acquisition System,” May 12, 2003; Chairman of the Joint Chiefs of Staff Instruction 3170.01E, “Joint Capabilities Integration and Development System,” May 11, 2005; and FAR, Subpart 6.1, “Full and Open Competition;” provide guidance on systems engineering, system development and demonstration documentation, capability requirements, and full and open competition, respectively.

DoD Directive 5000.1. DoD Directive 5000.1 requires acquisition programs to be managed by applying a systems engineering approach that optimizes system performance and minimizes ownership costs.

DoD Instruction 5000.2. DoD Instruction 5000.2 identifies documents that support the system development and demonstration decision review, such as the initial capabilities document and the capability development document.

5

Joint Chiefs of Staff Instruction. Chairman of the Joint Chiefs of Staff Instruction 3170.01E states that the Joint Requirements Oversight Council is the final validation and approval authority for capability development documents for programs that have the potential for joint interest.

Federal Acquisition Regulation. FAR, Subpart 6.1 prescribes the policy and procedures that are to be used to promote and provide for full and open competition.

Full and Open Competition. To ensure full and open competition and to eliminate impediments to competition, the acquisition strategy for the KC-X Program provides for the Air Force to competitively contract for as many as 80 commercial derivative aircraft of the intended procurement of 179 KC-X tanker aircraft. Consistent with FAR, Subpart 6.101, the KC-X Program Office promoted full and open competition in soliciting offers in its request for proposal for as many as 80 commercial derivative aircraft as described in the KC-X acquisition strategy. The competitive procurement acquisition strategy corrects the deficiencies in the previous leasing acquisition strategy for the Boeing KC-767A Tanker aircraft.

Appropriately Establishing Requirements. The KC-X Program Office appropriately established and included capabilities requirements in the KC-X request for proposal. The Air Force established those capabilities requirements through the Joint Capabilities Integration and Development System process in accordance with Chairman of the Joint Chiefs of Staff Instruction 3170.01E. The Air Force documented those capabilities in the initial capabilities document and the capability development document in accordance with DoD Instruction 5000.2. In addition, the KC-X Program Office properly established and included DoD acquisition requirements, including systems engineering, in the request for proposal to transform the capability requirements into an operationally effective and suitable system, in accordance with DoD Directive 5000.1 and DoD Instruction 5000.2.

Cost and Pricing Data

Acquisition Plan and Cost and Pricing Data Policy. FAR, Subpart 7.105, “Contents of Written Acquisition Plans,” stipulates the contents of acquisition plans. FAR, Subpart 15.403-4, “Requiring Cost or Pricing Data,” requires the contracting officer to obtain cost or pricing data only if the contracting officer concludes that an exception does not apply. Unless an exception applies, cost or pricing data are required before the award of any negotiated contract that is expected to exceed the current threshold of $650,000.

Cost and Pricing Data for the Sole-Source Acquisition. The Air Force planned to competitively contract for as many as 80 aircraft out of a total of 179 KC-X tanker aircraft and award that contract to one contractor. For the remaining acquisition of at least 99 KC-X aircraft, the Air Force intended to award a contract for the KC-X aircraft using a noncompetitive arrangement to the same contractor.

6

However, the Air Force did not have an approach for ensuring accurate, complete, and current cost and pricing data for the noncompetitive portion of the KC-X aircraft acquisition.

The Air Force planned to acquire the noncompetitive portion of the KC-X aircraft acquisition as early as FY 2016 with the winner of the initial competition, which is anticipated for the first quarter of FY 2008. In doing so, the Air Force did not include the following in the KC-X acquisition strategy, which is also the acquisition plan.

• The acquisition approach for the noncompetitive portion of the KC-X aircraft acquisition, in accordance with FAR Subpart 7.105

• A requirement to obtain accurate, complete, and current cost and pricing data to determine the reasonableness of the contractor’s proposed price for the noncompetitive portion of the KC-X aircraft acquisition, in accordance with FAR, Subpart 15.403-4

Effect of Not Updating the Acquisition Strategy. Without updating the acquisition strategy to include an approach for obtaining accurate, complete, and current cost and pricing data for the noncompetitive portion of the KC-X aircraft acquisition, the Air Force cannot:

• ensure that it accomplishes program objectives and contractual requirements within resource constraints, and

• evaluate price reasonableness to determine a fair and reasonable price.

Conclusion

To ensure that the Air Force obtains accurate, complete, and current cost and pricing data for the noncompetitive portion of the KC-X aircraft acquisition, the KC-X Program Office must update the KC-X acquisition strategy. Specifically, the update to the acquisition strategy should provide guidance for the acquisition approach beyond the initial request for proposal in accordance with FAR, Subpart 7.105, “Contents of Written Acquisition Plans.” The additional guidance should include a requirement to obtain certified cost and pricing data from the winning contractor to ensure that the Air Force receives a fair and reasonable price for the future noncompetitively acquired KC-X aircraft, in accordance with the FAR, Subpart 15.403-4, “Requiring Cost or Pricing Data.”

Management Comments on the Finding

The Assistant Secretary of the Air Force (Acquisition) concurred with the finding and stated that the Air Force KC-X Program Office will make appropriate changes to the specified documents at the first opportunity. For the complete text of the Assistant Secretary’s comments, see the Management Comments section of the report.

7

Recommendations, Management Comments, and Audit Response

A. We recommend that the Program Director, 653rd Aeronautical Systems Squadron (KC-X Program Office) update the acquisition strategy for the KC-X Aerial Refueling Tanker Aircraft Program to include guidance for the noncompetitive portion of the KC-X aircraft acquisition, in accordance with Federal Acquisition Regulation, Subpart 7.105, “Contents of Written Acquisition Plans.” The additional guidance in the acquisition strategy should include a requirement to obtain certified cost and pricing data from the winning contractor for the future noncompetitive portion of the KC-X aircraft acquisition, in accordance with the Federal Acquisition Regulation, Subpart 15.403-4, “Requiring Cost or Pricing Data.”

Air Force Comments. The Assistant Secretary of the Air Force (Acquisition) concurred with the recommendation. She stated that, consistent with the request for proposal, all contracts will include all required FAR clauses in accordance with FAR 15.403-4 to ensure that cost and pricing data are obtained for new aircraft and any modifications. The Assistant Secretary also stated that the KC-X Program Office will satisfy the finding by including this detailed information in the Acquisition Strategy Report update for milestone decision to enter the system development and demonstration phase of the acquisition process, anticipated by the end of 2007. For the complete text of the Assistant Secretary’s comments, see the Management Comments section of the report.

Audit Response. The Assistant Secretary’s comments are fully responsive and meet the intent of our recommendation.

8

B. Properly Establishing Information Assurance Guidance

The KC-X Program Office was not able to include consistent information assurance requirements in the KC-X capability development document, acquisition strategy, and request for proposal. The lack of consistent information occurred because the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer issued interim information assurance guidance without the proper coordination and approval of the Director, Administration and Management. The interim guidance, DIACAP, was to supersede guidance on the DoD Information Technology Security Certification and Accreditation Process (DITSCAP). However, DITSCAP remains the official DoD information assurance guidance until the DIACAP guidance is properly coordinated and approved in accordance with DoD policy.

Information Assurance Policy

DoD Directive 5025.1. DoD Directive 5025.1, “DoD Directives System,” July 14, 2004, provides policy and responsibilities governing DoD directives, instructions, and publications. The Directive requires the Director, Administration and Management, to review, coordinate, and approve DoD issuances.

DoD Instruction 5200.40. DoD Instruction 5200.40, “DoD Information Technology Security Certification and Accreditation Process (DITSCAP),” December 30, 1997, requires the Heads of the DoD Components to implement the DITSCAP for security certification and accreditation of DoD Component and DoD contractor information technology systems and networks.

Information Assurance Requirements

Consistent Information Assurance Requirements. The KC-X Program Office did not include consistent information assurance requirements in the KC-X capability development document, the acquisition strategy, and the request for proposal. Specifically, the Capability Development Document, December 27, 2006, requires the system to be certified and accredited in accordance with DITSCAP but also references DIACAP. However, the Acquisition Strategy, January 19, 2007, and the Final Request for Proposal, January 30, 2007, stipulate that DIACAP be followed exclusively for certification and accreditation. Those inconsistent information assurance requirements occurred because of improperly coordinated interim DIACAP guidance issued by the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer.

Properly Coordinating Interim Guidance. The Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer issued

9

interim information assurance guidance without proper coordination and approval of the Director, Administration and Management. Specifically, on July 6, 2006, the Assistant Secretary issued a memorandum, “Interim Department of Defense (DoD) Information Assurance (IA) Certification and Accreditation (C&A) Process Guidance,” that established interim guidance, including a draft instruction, for the DIACAP. The Assistant Secretary stated that the interim guidance superseded the DITSCAP and established procedures for information assurance certification and accreditation of DoD information systems to identify, implement, and manage information assurance capabilities and services.

DoD Directive 5025.1 requires proposed DoD issuances and cancellations to be formally coordinated with Heads of DoD Components to solicit their views. In addition, the Directive requires issuances to be coordinated with the DoD General Counsel; the DoD IG; and approved by the Director, Administration and Management at the Washington Headquarters Services. On August 2, 2006, a representative for the Washington Headquarters Services sent an e-mail to the Office of the Assistant Secretary of Defense for Networks and Information Integration stating that the DIACAP interim guidance could not supersede the DITSCAP guidance because the Office of the Assistant Secretary did not properly coordinate the interim guidance in accordance with DoD Directive 5025.1.

According to a representative from Washington Headquarters Services, until the DIACAP interim guidance or the proposed draft instruction is reviewed, coordinated, and approved by the Director, Administration and Management, DITSCAP remains the official DoD information assurance certification and accreditation policy.

Effect of Improper Information Assurance Guidance

Issuance of information assurance guidance before proper coordination, approval, and implementation, could place systems, such as the KC-X, at a greater risk of loss, misuse, or unauthorized access to or modification of the information contained in the systems.

Conclusion

To ensure consistent information assurance certification and accreditation guidance within the DoD, the Director, Administration and Management must approve guidance that has been properly coordinated with the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer and other DoD Components.

Because the Director, Administration and Management must approve any official DoD information assurance certification and accreditation policy, the KC-X Program Office should revise the applicable KC-X contracting documents to reference only the Director Administration and Management approved information assurance guidance.

10

Management Comments on the Finding

Air Force Comments. The Assistant Secretary of the Air Force (Acquisition) concurred with the finding and stated that the Air Force KC-X Program Office will make appropriate changes to the specified documents at the first opportunity. For the complete text of the Assistant Secretary’s comments, see the Management Comments section of the report.

Assistant Secretary of Defense for Networks and Information Integration Comments. Although not required to comment, the Senior Information Assurance Officer, Office of the Assistant Secretary of Defense for Networks and Information Integration/ DoD Chief Information Officer stated that the KC-X request for proposal was not inconsistent as it specifically identified DIACAP as the method for certification and accreditation. The Senior Information Assurance Officer stated that interim DIACAP guidance resulted in multiple information assurance benefits. The Senior Information Assurance Officer disagreed with finding statements that issuance of information assurance guidance before proper coordination, approval, and implementation, could place systems, such as the KC-X, at a greater risk of loss, misuse, or unauthorized access. For the complete text of the Senior Information Assurance Officer’s comments, see the Management Comments section of the report.

Audit Response. As noted in the finding, the KC-X Capability Development Document required the system to use DITSCAP guidance for certification and accreditation, thus clearly conflicting with the DIACAP requirement in the request for proposal. The Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer issuance of the interim DIACAP guidance was contrary to DoD Policy as the Director, Administration and Management, must approve any official DoD information assurance certification and accreditation policy after proper coordination in accordance with DoD Directive 5025.1.

Recommendations, Management Comments, and Audit Response

B.1. We recommend that by August 1, 2007, the Director, Administration and Management, according to his authority, and in coordination with the Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer:

a. Issue formal authoritative information assurance policy in accordance with DoD Directive 5025.1, “DoD Directives System,” July 14, 2004, or

b. Issue guidance to the Air Force regarding applicable information assurance certification and accreditation processes for inclusion in its KC-X contractual documents.

Director, Administration and Management Comments. The Director did not comment on the recommendation. We request that the Director provide comments in response to the final report.

Assistant Secretary of Defense for Networks and Information Integration/ DoD Chief Information Officer Comments. Although not required to comment, the Senior Information Assurance Officer, Office of the Assistant Secretary of Defense for Networks and Information Integration/ DoD Chief Information Officer stated that the Principal Staff Assistants are responsible for preparing, coordinating, and approving instructions within their areas of responsibility and that the recommendation should be redirected.

Audit Response. We disagree that the recommendation should be redirected because the Director, Administration and Management is the issuing authority in accordance with DoD Directive 5025.1. The current interim DIACAP guidance is presently being coordinated within DoD under DoD Directive 5025.1. The coordination process has yet to be completed.

B.2. We recommend that the Assistant Secretary of the Air Force (Acquisition) revise the applicable KC-X contractual documents to ensure consistency with the Director, Acquisition and Management approved information assurance policy as established in Recommendation B.1.

Air Force Comments. The Assistant Secretary of the Air Force (Acquisition) concurred with the recommendation and stated that the Air Force will ensure compliance with approved information assurance policy as established in Recommendation B.1. For the complete text of the Assistant Secretary’s comments, see the Management Comments section of the report.

Audit Response. The Assistant Secretary’s comments are fully responsive and meet the intent of our recommendation.

11

12

Appendix A. Scope and Methodology

On December 19, 2006, a member of Senator John McCain’s staff requested that we independently review and advise him on whether the Air Force request for proposal for an aerial tanker replacement contained impediments to competition and whether the request for proposal included capability or operational requirements for aircraft refueling and cargo transport. To accomplish the staff request and the audit objectives, we reviewed the following documentation and information dated from February 2004 through February 2007.

• Program documents including the Initial Capabilities Document, April 27, 2005; the Analysis of Alternatives for KC-135 Recapitalization, March 2006; the Objectivity Assessment of AoA for KC-135 Recapitalization, March 2006; the Tanker Acquisition Replacement Acquisition Decision Memorandum, April 13, 2006; the Draft Test and Evaluation Master Plan, November 29, 2006; the Capability Development Document, December 27, 2006; the Statement of Objectives, December 11, 2006; the Draft Acquisition Strategy, December 15, 2006; the KC-X Market Research Consolidated Report, December 22, 2006; the Acquisition Strategy, Version 03.2, January 19, 2007; the KC-X Acquisition Strategy Panel Minutes, January 29, 2007; the System Requirements Document, January 25, 2007; and the Draft Systems Engineering Plan, February 8, 2007.

• Contractual documents for the KC-X, including the Source Selection Plan, January 30, 2007; the Draft Request for Proposal, September 25, 2006; the Draft Request for Proposal, December 15, 2006; and the Final Request for Proposal, January 30, 2007.

• Acting Under Secretary of Defense for Acquisition, Technology, and Logistics Memorandum, “Analysis of Alternatives (AoA) Guidance for KC-135 Recapitalization,” February 24, 2004; Acting Under Secretary of Defense for Acquisition, Technology, and Logistics Memorandum, “KC-135 Recapitalization Analysis of Alternatives,” February 28, 2005; and Under Secretary of Defense for Acquisition, Technology, and Logistics Memorandum, “Tanker Replacement Acquisition Decision Memorandum (ADM),” April 13, 2006.

• Congressional documents, including the FY 2005 Department of Defense Appropriation Act, Section 8132, “Tanker Replacement Transfer Fund.”

• Management principles and mandatory policies for acquisition programs in DoD Directive 5000.1, DoD Instruction 5000.2, the Defense Acquisition Guidebook, the FAR, and management control provisions and key internal controls in Air Force policy.

We also contacted the staffs of the Offices of the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Assistant Secretary of Defense for

Networks and Information Integration/DoD Chief Information Officer; the Air Mobility Command; the Assistant Secretary of the Air Force (Acquisition); the Director, Operational Test and Evaluation; the Director, Administration and Management; the Director, the Program Analysis and Evaluation; the DoD Cost Analysis Improvement Group; the General Counsel, Department of the Air Force; the Program Executive Officer for Aircraft; the Deputy Chief of Staff for Air and Space Operations; the Program Director, 653rd Aeronautical Systems Squadron (KC-X Program Office); the Government Accountability Office (GAO); the RAND Corporation; and the Institute for Defense Analyses. We contacted those staff, as applicable, to

• evaluate the program management and procurement decision process used by the Air Force Acquisition Executive, the Program Executive Officer, and the contracting officer;

• evaluate the acquisition strategy and process based on criteria set forth in the DoD 5000 series, the FAR, and Air Force policy;

• evaluate the request for proposal for limitations in promoting competition;

• compare the request for proposal to the capability development document for the KC-X Program to determine whether the request for proposal adequately communicated Air Force requirements to prospective contractors;

• review the acquisition strategy to determine whether it included the required elements of an acquisition plan;

• review KC-X funding documentation to determine whether contractual options were constrained by funding availability;

• evaluate whether the Air Force implemented corrective actions on 14 outstanding recommendations made in DoD Inspector General (IG) Report No. D-2004-064, “Acquisition of the Boeing KC-767A Tanker Aircraft,” March 29, 2004 (see Appendix C for a discussion of the recommendations and corrective action);

• develop a matrix to verify the requirements flow from the initial capabilities document to the capability development document to the system requirements document and to the final request for proposal;

• compare the systems engineering section of the request for proposal to guidance in the Defense Acquisition Guidebook;

• evaluate the test and evaluation master plan to determine whether it included required tests for developmental and operational test and evaluation;

• evaluate information assurance requirements for complying with DoD policy;

13

• review the DoD policies concerning the DITSCAP and the DIACAP implementation;

• assess whether the Air Force adequately addressed capability, acquisition requirements, and systems engineering in the request for proposal;

• assess systems engineering process that the KC-X Program Office administered; and

• assess the Air Mobility Command’s Combined Mating and Ranging Planning System model at Scott Air Force Base, Illinois.

We performed this audit from December 2006 through April 2007 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Except for the following audit scope limitations, we believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Limitations to Audit Scope. We did not obtain or evaluate detailed Air Force supporting documentation for the KC-X Program analysis of alternatives, including cargo transport, because of the concurrent Government Accountability Office review of the analysis of alternatives (see Prior Coverage below and Appendix B). In addition, because of time limitations, we neither assessed the Air Mobility Command’s Combined Mating and Ranging Planning System model nor simulated, using modeling techniques, a mixed fleet of Airbus 330, Airbus 340, Boeing 767, and Boeing 777 aircraft to determine the actual cost savings and capabilities associated with such a fleet. Further, we did not assess the Joint Capabilities Integration and Development System process for generation, validation, and approval of the initial capabilities document and the capability development document because of time constraints.

Limitation to Auditor Independence. The Office of the DoD IG commented on the language to be included in the proposed DoD instruction pertaining to DIACAP.

Use of Computer-Processed Data. We did not use computer-processed data to perform this audit.

Use of Technical Assistance. The Technical Assessment Directorate, Office of the Deputy IG for Policy and Oversight determined whether the Air Force appropriately established and included DoD capability and acquisition requirements in the request for proposal for the KC-X Program.

Government Accountability Office High-Risk Area. The GAO has identified several high-risk areas in DoD. This report provides coverage of the DoD Weapon Systems Acquisition high-risk area.

14

15

Prior Coverage

During the last 5 years, the GAO has issued one report addressing the KC-X Program. Although the DoD IG has not issued any reports that specifically discuss the KC-X Program, the Air Force implemented recommendations from a previous audit of the Air Force aerial tanker lease in the acquisition strategy for the KC-X Program. Unrestricted GAO reports can be accessed over the Internet at http://www.gao.gov. Unrestricted DoD IG reports can be accessed at http://www.dodig.mil/audit/reports.

GAO

GAO Report No. GAO-07-367R, “Defense Acquisitions: Air Force Decision to Include a Passenger and Cargo Capability in Its Replacement Refueling Aircraft Was Made without Required Analyses,” March 6, 2007. See Appendix B for a discussion of this report.

DoD IG

DoD IG Report No. D-2004-064, “Acquisition of the Boeing KC-767A Tanker Aircraft,” March 29, 2004. See Appendix C for a discussion of this report and the Air Force implementation of the associated recommendations in the KC-X Program.

16

Appendix B. Government Accountability Office Report

Passenger and Cargo Capability. On March 6, 2007, the GAO issued Report No. GAO-07-367R, “Defense Acquisitions: Air Force Decision to Include a Passenger and Cargo Capability in Its Replacement Refueling Aircraft Was Made Without Required Analyses,” stating that military decision makers approved the passenger and cargo capability as a requirement without supporting analysis identifying the need or associated risk. The Air Force proposal for a replacement refueling aircraft included a passenger and cargo capability without identifying an associated gap, shortfall, or redundant capability. The GAO stated that, according to mandatory Air Force implementing guidance, analyses supporting the decision-making process should assess a capability based on the effects it seeks to generate and the associated operational risk of not having it. The GAO concluded that Air Force supporting analyses determined neither a need nor a risk with regard to a passenger and cargo capability. The GAO recommended that the Secretary of Defense:

• direct the Secretary of the Air Force to accomplish the required analyses that evaluate the proposed passenger and cargo capability to determine whether there was a gap, shortfall, or redundancy; assess the associated risk; and then submit such documentation to the Joint Requirements Oversight Council for validation; and

• once those analyses are completed, direct the Chairman, Joint Chiefs of Staff, to formally notify the Under Secretary of Defense for Acquisition, Technology, and Logistics that such analyses have been completed as required before certification of the program to Congress.

DoD disagreed with conducting the required analyses to establish whether a gap, shortfall, or redundancy existed and to assess risks associated with the proposed passenger and cargo capability in the replacement refueling aircraft. DoD stated that through the Joint Capabilities Integration and Development System process, the Air Force presented an analysis and rationale for the passenger and cargo capability. DoD further stated that its Joint Requirements Oversight Council and the Air Force concluded that the analysis was sufficient justification for the capability and that the Joint Requirements Oversight Council validated the requirement.

DoD agreed with the GAO recommendation to formally notify the Under Secretary of Defense for Acquisition, Technology, and Logistics once the required analyses have been completed. DoD stated that the Under Secretary of Defense for Acquisition, Technology, and Logistics will consider whether the Joint Requirements Oversight Council has accomplished its duties with respect to the program, including an analysis of the operational requirements of the program. DoD also stated that the Department would again review the justification for a passenger and cargo capability prior to making a decision to initiate the acquisition program.

In response to the DoD comments, GAO suggested that Congress require that:

• in addition to the certification described by section 2366a of title 10, United States Code, the Under Secretary of Defense for Acquisition, Technology, and Logistics make a specific certification that the Air Force had employed a sound, traceable, and repeatable process producing analyses that determined whether there was a gap, shortfall, or redundancy and assessed the associated risk with regard to passenger and cargo capability for the KC-135 Recapitalization; and

• consistent with service policy, those analyses are made available to the Joint Requirements Oversight Council before the Under Secretary’s certification of the program according to section 2366a of title 10, United States Code.

Analysis of Alternatives. The GAO plans to complete a review of the KC-X tanker analysis of alternatives and report the results in early summer 2007.

17

18

Appendix C. Recommendations Made to the Air Force in a Previous DoD Inspector General Report on the Tanker Aircraft

On March 29, 2004, we issued DoD Inspector General (IG) Report No. D-2004-064, “Acquisition of the Boeing KC-767A Tanker Aircraft,” stating that the Air Force used an inappropriate procurement strategy and demonstrated neither best business practices nor prudent acquisition procedures to provide sufficient accountability for the Boeing KC-767A Tanker Program.

Based on our findings, we recommended that DoD not proceed with the program until it resolves issues pertaining to the procurement strategy, acquisition procedures, and statutory requirements. We also recommended that the Deputy Secretary of Defense consider the following options.

• After implementation of audit recommendations to resolve contracting and acquisition issues, proceed with the sole-source acquisition of the Boeing KC-767A Tanker Program for 100 or fewer aircraft (Option 1).

• Initiate a new major Defense acquisition program based on the results of an analysis of alternatives for military tanker aircraft (Option 2).

• Implement a mix of Option 1 for some of the tankers and Option 2 for subsequent tankers.

On April 27, 2006, we requested that the Air Force provide comments on 14 open recommendations from the report.

On December 20, 2006, Air Force staff met with staff from the DoD IG to discuss the current status of actions to implement the open recommendations in DoD IG Report No. D-2004-064, “Acquisition of the Boeing KC-767A Tanker Aircraft,” March 29, 2004. In addition, to the current status, the Air Force staff provided an overview of the acquisition strategy for the KC-X tanker aircraft acquisition.

On December 22, 2006, the DoD IG issued a memorandum, “Followup on OIG Report No. D-2004-064, ‘Acquisition of the Boeing KC-767A Tanker Aircraft,’ March 29, 2004,” requesting that the Air Force provide an updated status report on the implementation of the open recommendations.

On March 15, 2007, the Assistant Secretary of the Air Force (Acquisition) issued a memorandum, “Follow-up on OIG Report D-2004-064, ‘Acquisition of the Boeing KC-767A Tanker Aircraft,’ March 29, 2004,” that addressed actions taken or planned to be taken to implement the 14 recommendations. Those actions met the intent of our recommendations, as shown in the following chart.

19

IG Recommendation Air Force Response

1. To discontinue the commercial item procurement strategy and replace it with a strategy that will use cost or fixed-price incentive contracts which would require Boeing to provide cost or pricing data as appropriate.

1. Final Request for Proposal, January 30, 2007, contains cost-plus-incentive fee/award fee contract for system development and demonstration and fixed-price-incentive fee for low rate initial production and production of the tanker aircraft.

2. Not use a fixed-price contract for development of the Boeing KC-767A Tanker aircraft and obtain cost or pricing data from Boeing to determine fair and reasonable prices for the Boeing KC-767A Tanker aircraft development work.

2. Contract will be cost-plus-incentive fee/award fee contract for system design and development and will require cost or pricing data in accordance with FAR, Subpart 15.403.

3. Not use a fixed-price contract for modification of the Boeing KC-767A Tanker aircraft and obtain cost or pricing data from Boeing to determine a fair and reasonable price for the Boeing KC-767A Tanker aircraft modification work.

3. Contract will be cost-plus-incentive fee/award fee contract for system development and demonstration and will require cost or pricing data in accordance with FAR, Subpart 15.403.

4. Require that the Air Force comply with DoD Directive 7600.2, “Audit Policies,” March 20, 2004, and contact the DoD IG for review and approval, as appropriate, before contemplating using non-Federal audit services in any contract.

4. Will comply with DoD IG recommendation and it is addressed in the acquisition strategy.

5. Require that the Defense Contract Audit Agency be used for the audit services in negotiated contracts for the Boeing KC-767A Tanker Program.

5. Air Force will use Defense Contract Audit Agency for audit services for the tanker program.

6. Not use a fixed-price contract for logistics support of the tanker program until an adequate baseline cost has been established and obtain cost or pricing data from Boeing to determine a fair and reasonable price for the integrated fleet support.

6. Air Force using fixed-price incentive fee contracts for interim logistics support and plans to transition to organic support.

20

7. Perform appropriate benchmarking of “performance aircraft availability” rates for other comparable aircraft systems before negotiating availability requirements in any contract for logistics support of the tanker program.

7. The System Requirements Document, January 25, 2007, specifies operational availability measures to be used based on other Air Mobility Command platforms.

8. Comply with statutory requirements in the National Defense Authorization Act for FY 2004; section 2464, title 10, United States Code, “Core Logistics Capability”; and the Strom Thurmond National Defense Authorization Act for Fiscal Year 1999 requiring analyses of the costs and benefits of organic or contractor support core logistics requirements, performance-based logistics, and contract length and notify Congress of its decision before selecting an integrated fleet support provider for the tanker program.

8. Air Force will conduct a business case analysis using applicable Source of Repair Assignment Process policy and instruction.

9. Establish a process to develop a performance metric for verifying that the Boeing KC-767A Tanker aircraft will meet the 40-year service life to satisfy warfighting requirements.

9. Offerors’ proposals will be evaluated during source selection for their approach. The Final Request for Proposal requires the implementation of the Aircraft Structural Integrity Program.

10. Revise the system specifications for the Boeing KC-767A Tanker contracts to include a requirement for protective measures to control corrosion in the tanker aircraft.

10. Corrosion control plan required in the Final Request for Proposal and each offeror’s approach to corrosion control will be evaluated during source selection.

11. Revise the system specifications for the Boeing KC-767A Tanker contracts to include requirements in the operational requirements document for interoperability with other systems, integration of secure communications, and combat identification.

11. The Final Request for Proposal; the Capability Development Document, December 27, 2006; and the System Requirements Document include Net-Ready key performance parameters. The System Requirements Document also includes other command, control, communication, computers, and intelligence requirements.

21

12. Complete a command, control, communication, computers, and intelligence support plan for the Boeing KC-767A Tanker aircraft to address interoperability, supportability, information assurance, and sufficiency concerns, include it in the statement of work before award of the contracts, and resolves issues identified by implementing the support plan before system acceptance testing.

12. The Air Force will complete the KC-X Information Support Plan before the decision to enter the system development and demonstration phase of the acquisition process.

13. Verify that system specifications developed for the first spiral of the air refueling aircraft contract(s) include at least all key performance parameters in the operational requirements document.

13. All capabilities development document key performance parameters are addressed in the Final Request for Proposal.

14. Comply with the statutory provisions by conducting operational and survivability testing on production representative aircraft before committing to the production of all 100 Boeing KC-767A Tanker aircraft.

14. Initial operational test and evaluation will be conducted in accordance with section 139, title 10, United States Code, “Director of Operational Test and Evaluation;” and section 2399, “Operational test and evaluation of defense acquisition programs.” The Alternative Live Fire Test Plan will be approved by the Director, Operational Test and Evaluation. Live Fire Test and Evaluation will be conducted in accordance with section 2366, title 10, United States Code, “Major systems and munitions programs: survivability testing and lethality testing required before full-scale production.” Initial operational test and evaluation testing and the associated final report will be completed before full-rate production.

22

Appendix D. KC-X Program Timeline of Events

The following chart illustrates the KC-X Program timeline of events and depicts those events in three timelines. The keys for all of the timelines are on the left side of the chart.

The timeline at the top of the page, “Requirements,” charts actual events associated with KC-X requirements that occurred between February 2004 and February 2007. The timeline includes the Under Secretary of Defense for Acquisition, Technology, and Logistics guidance; Joint Requirements Oversight Council validation of documents; and Senior Steering Group, RAND, Program Analysis and Evaluation, and Institute for Defense Analyses reviews for the recapitalization of the KC-135 tanker fleet.

The timeline in the middle of the page, “Acquisition,” represents actual events associated with KC-X acquisition efforts that occurred between September 2005 and February 2007. The timeline includes events that led up to the development of the acquisition strategy.

The timeline at the bottom of the page, “Contracting,” represents actual events associated with KC-X contracting that occurred between August 2005 and February 2007. The timeline includes events that led up to the release of the request for proposal.

THIS PAGE INTENTIONALLY LEFT BLANK

24

25

Appendix E. Glossary

Acquisition Plan. An acquisition plan is a written document reflecting the specific actions necessary to execute the approach established in the approved acquisition strategy and contractual documentation.

Acquisition Strategy. An acquisition strategy is a business and technical management approach designed to achieve program objectives within the resource constraints imposed. It is the framework for planning, directing, contracting for, and managing a program. It provides a master schedule for research, development, test, production, fielding, modification, post-production management, and other activities essential for program success. The acquisition strategy is the basis for formulating functional plans and strategies.

Aircraft Structural Integrity Program. The Aircraft Structural Integrity Program consists of a series of disciplined, time-phased actions, procedures, analyses, and tests. When developed and applied, the Program will ensure reliable, affordable, and supportable flight vehicle primary and secondary structures, and will enhance mission effectiveness and operational suitability while minimizing cost and schedule risks.

Analysis of Alternatives. The analysis of alternatives is the evaluation of the operational effectiveness, operational suitability, and estimated costs of alternative systems to meet a mission capability. The analysis assesses the advantages and disadvantages of alternatives being considered to satisfy capabilities, including the sensitivity of each alternative to possible changes in key assumptions or variables.

Capability Development Document. A capability development document contains the information necessary to develop a proposed program, normally using an evolutionary acquisition strategy. The capability development document outlines an affordable increment of militarily useful, logistically supportable, and technically mature capability. The capability development document should be approved before the system development and demonstration decision review.

Critical Design Review. A critical design review is conducted to determine whether the detailed design satisfies the performance and engineering requirements of the development specification; to establish the detailed design compatibility among the item and other items of equipment, facilities, computer programs and algorithms, and personnel; to assess producibility and risk areas; and to review the preliminary product baseline specifications. A critical design review is normally conducted during the system development and demonstration phase.

DoD Components. DoD Components are the Office of the Secretary of Defense; the Military Departments; the Chairman, Joint Chiefs of Staff and Joint Staff; the Unified Combatant Commands; the Defense agencies; and DoD field activities.

Full-and-Open Competition. Full-and-open competition for a contract means that all responsible sources are permitted to compete.

Information Assurance. Information assurance means that information operations protect and defend information and information systems by ensuring their availability, integrity, confidentiality, authentication, and nonrepudiation. Information assurance provides for the restoration of information systems by incorporating protection, detection, and reaction capabilities.

Information Technology. Information technology is any equipment or interconnected system or subsystem of equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. Information technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources, including National Security Systems.

Initial Capabilities Document. An initial capabilities document describes a need for a materiel approach to a specific capability gap. The initial capabilities document defines the gap in terms of the functional area, the relevant range of military operations, the desired effects, and time. It also summarizes the results of doctrine, organization, training, materiel, leadership, personnel, and facilities analyses; and describes why nonmateriel changes are inadequate to provide the desired capability.

Joint Capabilities Integration and Development System. The Joint Capabilities Integration and Development System supports the Chairman, Joint Chiefs of Staff and the Joint Requirements Oversight Council in identifying, assessing, and prioritizing joint military capability needs as required by law.

Joint Requirements Oversight Council. The Joint Requirements Oversight Council validates and approves the Joint Capabilities Integration and Development System documents for programs of interest to the Joint Requirements Oversight Council.

Key Performance Parameters. Key performance parameters are those capabilities that are considered to be so significant that failure to meet them can be cause for a system to be reevaluated or the program to be reassessed or terminated.

Low-Rate Initial Production. Low-rate initial production is the first effort of the production and deployment phase of the acquisition process. The purpose of this effort is to establish an initial production base for the system, permit an orderly ramp-up sufficient to lead to a smooth transition to full-rate production, and to provide production-representative articles for initial operational test and evaluation and live-fire testing.

Major Defense Acquisition Program. A major Defense acquisition program is an acquisition program that the Under Secretary of Defense for Acquisition, Technology, and Logistics designates as a major Defense acquisition program or estimates to require an eventual total expenditure for research, development, test and evaluation of more than $365 million in FY 2000 constant dollars or, for procurement, of more than $2.19 billion in FY 2000 constant dollars.

26

Request for Proposal. A request for proposal is a solicitation used in negotiated acquisitions to communicate Government requirements to prospective contractors.

Service Acquisition Executive. Service Acquisition Executives or DoD Component Acquisition Executives are Secretaries of the Military Departments or the Heads of Agencies, who can delegate that authority. The Service Acquisition Executives are responsible for all acquisition functions within their Military Department. Regarding the Air Force, the Service Acquisition Executive is the Assistant Secretary of the Air Force (Acquisition).

Source of Repair Assignment Process. The Source of Repair Assignment Process is used to determine whether the permanent source for accomplishment of a depot level maintenance workload.

Statement of Objectives. A statement of objectives is that portion of a contract that establishes a broad description of the Government’s required performance objectives.

System Development and Demonstration. The system development and demonstration phase is the third phase of the DoD systems acquisition process, which begins after the milestone decision to enter this phase. This phase consists of system integration and system demonstration and contains a design readiness review at the conclusion of the system integration effort.

System Requirements Document. A system requirements document is a high-level engineering document that expresses the user’s capability needs as system requirements. For the KC-X Program, the system requirements document presents the technical performance required for the replacement tanker aircraft.

Systems Engineering. Systems engineering is the overarching process that a program team applies to transition from a stated capability to an operationally effective and suitable system. Systems engineering encompasses the application of systems engineering processes across the acquisition life cycle and is intended to be the integrating mechanism for balanced solutions addressing capability needs, design considerations and constraints, as well as limitations imposed by technology, budget, and schedule.

Systems Engineering Plan. A systems engineering plan is a description of a program’s overall technical approach that includes processes, resources, metrics, applicable performance incentives, and the timing, conduct, and success criteria of technical reviews.

Test and Evaluation Master Plan. A test and evaluation master plan documents the overall structure and objectives of the test and evaluation program. It provides a framework within which to generate detailed test and evaluation plans, and it documents the schedule and resources for the test and evaluation program. The test and evaluation master plan identifies the necessary activities for developmental test and evaluation, operational test and evaluation, and live-fire test and evaluation. Further, the test and evaluation master plan links program

27

schedule, test management strategy and structure, and required resources with critical operational issues, critical technical parameters, and objectives and thresholds in the operational requirements document.

28

29

Appendix F. Report Distribution

Office of the Secretary of Defense

Under Secretary of Defense for Acquisition, Technology, and Logistics Director, Acquisition Resources and Analysis

Under Secretary of Defense (Comptroller)/Chief Financial Officer Deputy Chief Financial Officer Deputy Comptroller (Program/Budget)

Assistant Secretary of Defense for Networks and Information Integration/DoD Chief Information Officer

Director, Operational Test and Evaluation Director, Administration and Management

Director, Washington Headquarters Services Director, Program Analysis and Evaluation

Joint Staff Director, Joint Staff

Director for Force Structure, Resources, and Assessment (J-8)

Department of the Navy Naval Inspector General Auditor General, Department of the Navy

Department of the Air Force Commander, Air Mobility Command Assistant Secretary of the Air Force (Acquisition)

Program Executive Officer for Aircraft Program Director, 653rd Aeronautical Systems Squadron

Assistant Secretary of the Air Force (Financial Management and Comptroller) General Counsel, Department of the Air Force Deputy Chief of Staff for Air and Space Operations Auditor General, Department of the Air Force

Non-Defense Federal Organizations Office of Management and Budget U.S. Government Accountability Office

30

Congressional Committees and Subcommittees, Chairman and Ranking Minority Member

Senate Committee on Appropriations Senate Subcommittee on Defense, Committee on Appropriations Senate Committee on Armed Services Senate Committee on Homeland Security and Governmental Affairs House Committee on Appropriations House Subcommittee on Defense, Committee on Appropriations House Committee on Armed Services House Committee on Oversight and Government Reform House Subcommittee on Government Management, Organization, and Procurement,

Committee on Oversight and Government Reform House Subcommittee on National Security and Foreign Affairs,

Committee on Oversight and Government Reform

November 28, 2006ASP reviews the acquisition strategy

and approval is on hold until resolution of concerns

November 14, 2006SECAF & SAF/AQ select single

contract award strategy contained within Draft RFP and direct program office

to proceed with actions for Final RFP release

September 23, 2005Acting SECAF ceases all

activities related to tanker recapitalizationJanuary 17, 2007

SECAF and USD(AT&L) meeting results in

agreement to sign ASR and proceed with Final RFP release

January 2005 December 2007

2006 2007

April 13, 2006USD(AT&L) authorizes the

Air Force to resume the requirements and acquisition

processes necessary for a competitive acquisition program

September 2005 - April 2006Program Pause

Nov 28, 2006 - Jan 19, 2007ASR Approval Process

January 2004 December 2007

2005 2006 2007

January 25, 2007

February 24, 2004USD(AT&L) directs that an AoA for

KC-135 recapitalization be undertaken under the oversight of a SSG

May 25, 2004USD(AT&L) changes AoA original

completion date of August 2005 to November 2004

May 28, 2004SSG chooses RANDto conduct the AoA

January 25, 2005SSG concludes additional

analysis is needed to complete the AoA

February 28, 2005USD(AT&L) directs additional

work be done on AoA by RAND

January 18, 2006DAB review

of KC-135 AoA

March 2006

March 2006IDA determines the AoA final report is objective and provides appropriate

foundation for the next steps in the decision process

April 5, 2006PA&E determines the AoA provides sufficient basis for

upcoming acquisition decisions

August 2005

August 2005 - December 2005IDA Methodology and Objectivity Review

& PA&E Sufficiency Review

December 2004

June 16, 2004November 29, 2006

CONTRACTING

ACQUISITION

REQUIREMENTS

Analysis of Alternatives Study Plan July 16, 2004

Acquisition Strategy Draft December 15, 2006

Analysis of Alternatives March 2006

Initial Capabilities Document November 30, 2004

Capabilities Development Document December 27, 2006

Analysis of Alternatives Drafts

Acquisition Strategy January 19, 2007

System Requirements Document January 25, 2007

Source Selection Plan January 30, 2007

Market Research Plan April 25, 2005

Market Research Consolidated Report December 22, 2006

Test and Evaluation Master Plan Draft November 29, 2006

Request for Proposal Draft September 25, 2006

Request for Proposal Draft December 15, 2006

Request for Proposal January 30, 2007

November 30, 2004JROC validates ICD

April 2006 - September 2006Program status updates to SECAF

result in 25 Sep 06' Draft RFP released to industry

January 2005 December 2007

2006 2007

August 26, 2005Initial RFI is released

before completion of AoA

June 9, 2006Responses from industry

to RFI released 25 Apr 06'April 25, 2005

December 15, 2006December 22, 2006

Key

KC-X PROGRAM

Acquisition Decision Memorandum April 13, 2006

September 2, 2005Deputy Secretary of Defense indicates

Air Force rescinded initial RFI released in August 2005

Projected Milestone B (SDD) September 2007

September 12, 2006Program office directed to include wording in 25 Sep 06' Draft RFP

indicating intention for single contract award with right for multiple

contract award

Industry Days October 24- 26, 2006

January 30, 2007

Draft RFP contains language for single contract award only

Nov 29, 2006 - Jan 17, 2007Discussions between USD(AT&L),

SECAF, and SAF/AQ result in reduction of contract options from 7 to 5

October 2006 - November 2006Alternate acquisition strategies

evaluated with multiple briefings to SAF/AQ

Systems Engineering Plan Draft February 8, 2007

23

December 27, 2006JROC validates CDD

Offerors’ Proposals Due April 2, 2007

Acronym Key

Acquisition Strategy Report

Defense Acquisition Board

Acquisition Strategy Panel

Institute for Defense Analyses

Senior Steering Group

Joint Requirements Oversight Council

Request for Information

Low Rate Initial Production

Capability Development Document

JROC

Full Rate ProductionFixed Price Incentive Firm Target

Cost Plus Incentive Fee

Under Secretary of Defense for Acquisition, Technology, & Logistics

Analysis of Alternatives

Program Analysis & Evaluation

Initial Capabilites Document

USD(AT&L)

RFI

LRIP

ICD

PA&E

FRP

ASPAoA

CDDASR

DABFPIF

CPIF

IDA

System Development & DemonstrationSDD

CSAF

SSGSecretary of the Air Force

Assistant Secretary of the Air Force (Acquisition)SAF/AQRequest for ProposalRFP

SECAF

Chief of Staff, United States Air Force

Request for Information April 25, 2006

December 12, 2006CPIF contract type selected for SDD

January 20, 2007FPIF contract type

selected for LRIP and FRP

April 25, 2006Air Force

re-issues RFI

Department of the Air Force Comments

DEPARTMENT OF THE AIR FORCE WASHINGTON DC

MAY 1 0 2007 OFFICE OF THE ASSISTANT SECRETARY

MEMORANDUM FOR DEPARTMENT OF DEFENSE INSPECTOR GENERAL ATTN: DEPUTY INSPECTOR GENERAL. TOR AUDITING

ACTING DEPUTY INSPECTOR GENERAL TOR POLICY AND OVERSIGHT

FROM: SAF/AQ

SUBJECT: Draft Report on the Air Force KC-X Aerial Refueling Tanker Aircraft Program (Project Nos. D:007-D000AB.0099.000 and D2007-D000PT-0110.000)

This is in reply to your 26 April 2007 memorandum requesting review and comment on the subject report. We concur with the report's two findings and the recommendations. The Air Force Program Office will make appropriate changes to the specified documents at [he first Opportunity, The attached is provided to respond to the recommendations addressed to the Air Force.

My staff stands ready to provide additional information upon your request. My point of contact is Ms Shelly Alvirez, 703-588-8330.

SUE C. PAYTON

Assistant Secretary of the Air Force

(Acquisition)

cc: Audit Follow-up Focal Point, OUSD (AT&L) Air Force Audit Follow-up Focal Point, SAF/FMPF AUD-ACM

Attachment: Response to OIG Findings

Attachment Air Force Response OIG Findings

OIG Draft Report, "Air Force KC-X Aerial Refueling Tanker Aircraft Program," 26 April 2007, Project Numbers D2007-D000AB-0099.000 and D2007-D000PT-0110.000

RECOMMENDATION A: We recommend that the Program Director, 653rd Aeronautical Systems Squadron (KC-X Program Office) update (be acquisition strategy for the KC-X Aerial Refueling Tanker Aircraft Program to include guidance for the noncompetitive portion of the KC-X aircraft acquisition, in accordance with Federal Acquisition Regulation, Subpart 7.105, "Contents of Written Acquisition Plans." The additional guidance in the acquisition strategy should include a requirement to obtain certified cost and pricing data from the winning contractor for the future noncompetitive portion of the KC-X aircraft acquisition, in accordance with Federal Acquisition Regulation, Subpart 15.403-4, "Requiring Cost or Pricing Data."

RESPONSE: Concur. Consistent with the Request for Proposal, all contracts will include all required FAR clauses IAW FAR 15.403 to ensure cost and pricing data is obtained for new aircraft and any modifications. The program office will satisfy the DoD/IG finding by including this detailed information in the Acquisition Strategy Report update for Milestone B, anticipated by the end of 2007.

RECOMMENDATION B: We recommend that the Assistant Secretary of the Air Force (Acquisition) revise the applicable KC-X contractual documents to ensure consistency with the Director, Administration and Management approved information assurance policy as established in Recommendation B.1.

RESPONSE: Concur. The Air Force will ensure compliance with approved information assurance policy as established in Recommendation B.1.

32

OFFICE OF THE ASSISTANT SECRETARY OF DEFENSE 6 0 0 0 DEFENSE PENTAGON

WASHINGTON. DC 20301-6000

NETWORKS AND INFORMATION INTEGRATION May 18, 2007

MEMORANDUM FOR DEPUTY INSPECTOR GENERAL FOR AUDITING, DEPARTMENT OF DEFENSE ACTING DEPUTY INSPECTOR GENERAL FOR POLICY AND OVERSIGHT, DEPARTMENT OF DEFENSE

SUBJECT: Department of Defense Inspector General Draft Report (D-2007-D000AB-0099; D2007-D000PT-0110), "Air Force KC Aerial Refueling Tanker Aircraft Program," April 26, 2007

This office has the Following comments regarding Section B of the draft report:

• On page 8 under "Information Assurance Requirements," the first paragraph stares that the KC-X Program did not include consistent information assurance guidance. However, the KC-X Capability Development Document identified a likely transition from the DITSCAP to the DIACAP as the new method for certification and accreditation of the KC-X Program and both the Acquisition Strategy and Request for Proposal, issued subsequently, specifically identified the DIACAP as the method of certification and accreditation for the Program, thus confirming the transition and making it abundantly clear that the DIACAP is to be followed. This is not "inconsistent" guidance,

• On page 8 under "Effect of Improper Information Assurance Guidance," the Page 9 paragraph implies that the KC-X Program was at greater risk of loss, misuse, or unauthorized access or modification of the information contained in the systems because the Interim DIACAP was "improperly" coordinated. In fact, the Interim DIACAP was based on a draft DoD issuance on certification and accreditation that was concurred in by all of the DoD Components except the DoD IG. Further, the actual protection of systems and information is dependent on the implementation of appropriate information assurance controls, which are addressed through invoking DoDD 8500. i and DoD! 8500,2, so the proper employment of either process (DIACAP or DITSCAP) to validate the information assurance controls will result in an appropriately accredited system. The Interim DIACAP does allow more accurate and consistent reporting on the testing and evaluations required under FISMA, facilitates communication of accreditation status, and lends itself to automation. These three benefits are compelling reasons for issuing the Interim DIACAP.

33

• On page 10 under "Recommendations," B.1.a.recommends that the Director, Administration and Management (DA&M), by August 1, 2007, "issue formal authoritative information assurance policy," Under DoD Directive 5025.1, DoD Directives System." July 14, 2004, the DA&M is responsible for administering and operating the DoD Directives System, however, the Principal Staff Assistants are responsible for preparing, coordinating, and approving instructions within their areas of responsibility. The recommendation should be amended accordingly,

The OASD (NII) 1A Directorate POC for this action is Donald Jones at (703) 614-6640, Donald.jones@osd.mil.

Robert F. Lentz Senior Information Assurance Officer

34

Team Members The Department of Defense Office of the Deputy Inspector General for Auditing, Acquisition and Contract Management, and the Office of the Deputy Inspector General for Policy and Oversight, prepared this report. Personnel of the Department of Defense Office of Inspector General who contributed to the report are listed below.

Acquisition and Contract Management Richard B. Jolliffe Bruce A. Burton Benjamin A. Mehlman Jack D. Snider Susan J. Lippolis Neal Gause Chrispian M. Brake Bernard Vennemann Zorayma Torres Jessica Vandemark Monica Noell Policy and Oversight Patricia A. Brannin Kenneth H. Stavenjord Jamie A. Bobbio Charles Dekle Anh Tran Minh Tran